- Freeradius-Users - lists.freeradius.org

Missing NAS-Port in Access request with respect to RFC 2865
by Ramm-Ericson, Johannes 07 Apr '08

07 Apr '08

Hello Freeradius-users, >From what I see in the mailing list archives several freeradius users have historically run into trouble with Access-Request information sent by NASes and particularly the lack of the NAS-Port attribute. I've run into it quite often recently and was wondering if I may have found a way to solve it. The workaround I currently employ is to configure acct_users to let the access request from the NAS in question through anyway but it's a workaround. If possible I'd like to find the *correct* solution.... :-) The RFC 2865 http://www.freeradius.org/rfc/rfc2865.html#NAS-Port states that: "Either NAS-Port or NAS-Port-Type (61) or both SHOULD be present in an Access-Request <http://www.freeradius.org/rfc/rfc2865.html#Access-Request> packet, if the NAS differentiates among its ports." >From what I understand the current Freeradius code interprets the RFC statement so that if the NAS-Port attribute is not sent then the access request is not processed and subsequently denied (in rlm_radutmp.c - line 404). if (!port_seen) { However; shouldn't the statement from the RFC be intertpreted such that if *neither* the NAS-Port or the NAS-Port-Type is set then the access request should not be processed and subsequently denied? I'm thinking something along the lines of changing line 404 of rlm_radutmp.c to: if (!port_seen && !nas_port_type) { I'll apologise in advance if my all too rusty programming skills are making me misunderstand the situation entirely... Best Regards, Johannes Ramm-Ericson ----------------------------------------------------------- The information in this e-mail, and attachment(s) thereto, is strictly confidential and may be legally privileged. It is intended solely for the named recipient(s), and access to this e-mail, or any attachment(s) thereto, by anyone else is unauthorized. Violations hereof may result in legal actions. Any attachment(s) to this e-mail has been checked for viruses, but please rely on your own virus-checker and procedures. If you contact us by e-mail, we will store your name and address to facilitate communications in the matter concerned. If you do not consent to us storing your name and address for above stated purpose, please notify the sender promptly. Also, if you are not the intended recipient please inform the sender by replying to this transmission, and delete the e-mail, its attachment(s), and any copies of it without, disclosing it.

3 3

compare check items in LDAP - pairs do not match
by mel 07 Apr '08

07 Apr '08

Hi, When I set compare_check_items in modules { ldap {} }, I'm getting the errors below: rad_recv: Access-Request packet from host 127.0.0.1 port 58575, id=39, length=96 User-Name = "user10" User-Password = "abc123" Calling-Station-Id = "00:18:DE:28:7C:7C" Message-Authenticator = 0xcfe57cf5ca3366338fd35142085e45b8 EAP-Message = 0x02d2000b01757365723130 +- entering group authorize ++[preprocess] returns ok rlm_ldap: - authorize rlm_ldap: performing user authorization for user10 expand: (uid=%u) -> (uid=user10) expand: dc=iiu,dc=edu,dc=my -> dc=iiu,dc=edu,dc=my rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=iiu,dc=edu,dc=my, with filter (uid=user10) rlm_ldap: checking if remote access for user10 is allowed by radiusFilterId rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute macAddress as RADIUS attribute Calling-Station-Id == "00:18:DE:28:7C:7C" rlm_ldap: LDAP attribute userPassword as RADIUS attribute User-Password == "{sha}Y2fEjdGT1W6nsLqtJbGUVeUp9e4=" rlm_ldap: looking for reply items in directory... rlm_ldap: LDAP attribute radiusFilterId as RADIUS attribute Filter-Id = "1" rlm_ldap: Pairs do not match. Rejecting user. rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns reject Invalid user (rlm_ldap: Pairs do not match): [user10/abc123] (from client localhost port 0 cli 00:18:DE:28:7C:7C) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> user10 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 39 to 127.0.0.1 port 58575 Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 39 with timestamp +42 Ready to process requests. In ldap.attr, Calling-Station-Id is mapped to macAddress. In modules checkval, item-name is Calling-Station-Id, while check-name is macAddress. The macAddress is stored using ":" as delimiter in OpenLDAP What I was tasked to do is to authorize the user based on the password and macAddress pair. Prior to this, I've been able to do the following successfully - basic LDAP authentication with username/password stored in LDAP - EAP-TTLS with username/password stored in LDAP - EAP-GTC with username/password stored in LDAP - PAP with username/password stored in LDAP These have been tested locally (using radtest and radeapclient) and also via a NAS. Regards, --mel

1 0

mera vsa on freeradius
by Budi Wibowo 07 Apr '08

07 Apr '08

dear all anybody have mera vsa or dictionary for freeradius? i want to make call performance base on the that. br budi

1 0

EAP Authentication
by Devinder Singh 07 Apr '08

07 Apr '08

Hi I have set up Free Radius to allows users to set up certificates on their notebook and get access to the Internet. When i set EAP i cant sem to allow monowall captiv portal users to login to the RADIUS Server. Is there any settings to be done in users.conf file or radiusd .conf file to allow users to login via the monowall captive portal login page. FREE Radisu rejects login from the caprive portal login. Shoud i be using MSCHAP or can i still use EAP. Thank you Devinder

2 7

Re: Freeradius + CHAP
by SANDY KALUGDAN 06 Apr '08

06 Apr '08

That looks familiar? :P How about for the other tables? any pointers? ----- Original Message ---- From: Ivan Kalik <tnt(a)kalik.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Sunday, April 6, 2008 21:11:58 Subject: Re: Freeradius + CHAP "I modified my rachek table to look like this. as you have mentioned. mysql> select * from radcheck -> ; +----+----------+--------------------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+--------------------+----+-------+ | 1 | s | Cleartext-Password | := | s | | 2 | steve | Cleartext-Password | := | s | +----+----------+--------------------+----+-------+ 2 rows in set (0.00 sec)" That should do it. Ivan Kalik Kalik Informatika ISP Dana 6/4/2008, "SANDY KALUGDAN" <sandykalugdan(a)yahoo.com> piše: >Ok, I shall definitely remove the old version. I already found where I should insert the sql. Ivan is right, it is in the sites-enabled folder. >Anyone kind enough to provide me some sample data that I could insert in my sql table? > >----- Original Message ---- >From: "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> >To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> >Sent: Sunday, April 6, 2008 19:25:48 >Subject: Re: Freeradius + CHAP > >Hi, > >> Configuration so much different. Where shall I include sql for the radius to look into mysql database? Before I just open and radiusd.conf and insert the sql into, authorize & accounting. Now, I am at a total loss. > >sql.conf > > >i'd advise removing the 1.0.1 that your distro dropped in. > >rpm -e freeradius > >then you know all action (eg dictionaries) is from 2.0.3 > >just read the config files - all the files they use then become >clear. red sql.conf and you'll see which engine/dialup.conf >etc is used > >alan >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > >Send instant messages to your online friends http://uk.messenger.yahoo.com > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Re: Freeradius + CHAP
by SANDY KALUGDAN 06 Apr '08

06 Apr '08

Ok, I shall definitely remove the old version. I already found where I should insert the sql. Ivan is right, it is in the sites-enabled folder. Anyone kind enough to provide me some sample data that I could insert in my sql table? ----- Original Message ---- From: "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Sunday, April 6, 2008 19:25:48 Subject: Re: Freeradius + CHAP Hi, > Configuration so much different. Where shall I include sql for the radius to look into mysql database? Before I just open and radiusd.conf and insert the sql into, authorize & accounting. Now, I am at a total loss. sql.conf i'd advise removing the 1.0.1 that your distro dropped in. rpm -e freeradius then you know all action (eg dictionaries) is from 2.0.3 just read the config files - all the files they use then become clear. red sql.conf and you'll see which engine/dialup.conf etc is used alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Re: Why my schema is not working?
by snaut＠snaut.ru 06 Apr '08

06 Apr '08

And any ideas? I'm sure, that this bug is very important. >Yes, a'm fix it. -----Original Message----- From: freeradius-users-bounces+snaut=snaut.ru at lists.freeradius.org [mailto:freeradius-users-bounces+snaut=snaut.ru at lists.freeradius.org] On Behalf Of Ivan Kalik Sent: Friday, April 04, 2008 4:57 PM To: freeradius-users at lists.freeradius.org Subject: RE: Why my schema is not working? And the warning about using User-Password is now gone from the debug? Ivan Kalik Kalik Informatika ISP Dana 4/4/2008, "Dmitry A. Sysoev" <snaut at snaut.ru> piše: >SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = >'250092020001115 at evdo.uln.skylink.ru' ORDER BY id > >1 4732 250092020001115 at evdo.uln.skylink.ru Cleartext-Password >EBLAImXtaUidLnSa := > > SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = >'250092020001115 at evdo.uln.skylink.ru' ORDER BY id > >1 4147 250092020001115 at evdo.uln.skylink.ru Callback-Id >0250092020001115 == > >SELECT GroupName FROM usergroup WHERE >UserName='250092020001115 at evdo.uln.skylink.ru' OR CLID='' order by >priority > >1 blackholed > >SELECT >radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgro >upche ck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE >(usergroup.Username = '250092020001115 at evdo.uln.skylink.ru' or >usergroup.CLID = '') AND usergroup.GroupName = radgroupcheck.GroupName >ORDER BY usergroup.PRIORITY,radgroupcheck.id > >1 181 blackholed Auth-Type Reject := >2 182 blackholed Fall-Through No = > > > >-----Original Message----- >From: freeradius-users-bounces+snaut=snaut.ru at lists.freeradius.org >[mailto:freeradius-users-bounces+snaut=snaut.ru at lists.freeradius.org] >On Behalf Of Ivan Kalik >Sent: Friday, April 04, 2008 4:32 PM >To: freeradius-users at lists.freeradius.org >Subject: RE: Why my schema is not working? > >What happens when you copy and paste the query from the debug? Can you >post the result? > >I would doubt that the code is "alergic" to that particular group and >works for others. "blackholed" doesn't look like a reserved word. >Queries are executed by mysql not radius server. > >Ivan Kalik >Kalik Informatika ISP > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html > >

1 0

Special Characters for special Attributes
by Leander S. 06 Apr '08

06 Apr '08

Hi, I use FreeBSD 7.0 and have mpd as PPPoE Server & FreeRADIUS & PGSQL succesfully running. My goal now is it to shrink down the Bandwidth for each user with the help of IPFW and Dummynet which is supported by mpd and shouldn't be that big of a deal. That's how my /usr/local/etc/raddb/users looks like: ############################################### test User-Password == "testpasswd" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 1.2.3.4, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1492, Framed-Compression = Van-Jacobsen-TCP-IP, mpd-table += "1=11.1.11.1", mpd-table += "1=1.2.3.4", mpd-pipe += "1=bw 20Kbyte/s", mpd-pipe += "5=bw 10Kbyte/s", mpd-rule += "1=pipe %p1 all from any to table\(%t1\) in", mpd-rule += "2=pipe %p5 all from table\(%t1\) to any out", mpd-rule += "100=allow all from any to any", [...] ############################################### The last few lines are responsible for limiting the bandwidth but those brackets causing trouble because FreeRADIUS doesn't send it like that to mpd5. ----------------------------------------------------------------------------------------------- ----------------------------------------------------------------------------------------------- ... somebody told me: IPFW rules are operated using shell+ipfw execution. So you should add slashes before shell special chars, like "(" or ")": mpd-rule += "1=pipe %p1 all from any to table\(%t1\) in", mpd-rule += "2=pipe %p5 all from table\(%t1\) to any out", PS: you RADIUS configuration syntax may require additional slashing for that slashes. :) [...] Enable 'log +radius2' in mpd and make sure that rules coming to mpd with that slashes added. If there will be no slashes, then you RADIUS config strips them and you should add slashes for slashes. ----------------------------------------------------------------------------------------------- ----------------------------------------------------------------------------------------------- here is a part of mpd5's log to have look how RADIUS sending those attributes to mpd5: ############################################### [...] [rl0-3] RADIUS: RadiusGetParams: RAD_MPD_RULE: 1=pipe %p1 all from any to table\(%t1) in [rl0-3] RADIUS: RadiusGetParams: RAD_MPD_RULE: 2=pipe %p5 all from table\(%t1) to any out [...] ############################################### ^^ ... so you see .. one of that slashes is missed ... BUT how do I get those two Lines: [...] [rl0-3] RADIUS: RadiusGetParams: RAD_MPD_RULE: 1=pipe %p1 all from any to table\(%t1) in [rl0-3] RADIUS: RadiusGetParams: RAD_MPD_RULE: 2=pipe %p5 all from table\(%t1) to any out [...] looking like they do look in the /usr/local/etc/raddb/users ? Thank you Regards, Leander

2 1

Re: Freeradius + CHAP
by SANDY KALUGDAN 06 Apr '08

06 Apr '08

Configuration so much different. Where shall I include sql for the radius to look into mysql database? Before I just open and radiusd.conf and insert the sql into, authorize & accounting. Now, I am at a total loss. I'm now running using the 2.0.3 finally. here is my radiusd -X output [root@host redhat]# /usr/local/sbin/radiusd -X FreeRADIUS Version 2.0.3, for host i686-pc-linux-gnu, built on Apr 6 2008 at 16:19:04 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. Send instant messages to your online friends http://uk.messenger.yahoo.com

3 2

Re: Freeradius + CHAP
by SANDY KALUGDAN 06 Apr '08

06 Apr '08

I run /usr/local/sbin/radiusd -X tsk, tsk. [root@host redhat]# /usr/local/sbin/radiusd -v radiusd: FreeRADIUS Version 2.0.3, for host i686-pc-linux-gnu, built on Apr 6 2008 at 16:19:04 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. ----- Original Message ---- From: "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Sunday, April 6, 2008 16:21:04 Subject: Re: Freeradius + CHAP Hi, > I was surprised myself to see this. All the while I thought that I'm running the 2.0.3 version. I've check my source install folder and the tar.gz download. I both says that it's version 2.0.3. /usr/local/sbin/radiusd by any chance? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

1 0